Open workspace

Guide · South African regulation

POPIA, explained for those who monetize with ads

POPIA is South Africa's data protection law. It protects people and also companies, has tough rules for email and SMS marketing and provides for fines and even prison. See what it asks of a site with South African visitors and what it changes for ads.

Audit my site's privacyRead the guide
  • ✓Based on the text of the law and Information Regulator publications
  • ✓Examples of sites with ads, including Brazilian ones
  • ✓Read-only scan, no changes to the site
R10Mmaximum administrative fine the Information Regulator can impose
8conditions that all data processing must meet to be lawful
18years: below this age, the person is treated as a child by the law
2021year the adaptation period ended, on June 30

What it is

A law that protects people and companies

The Protection of Personal Information Act, or POPIA, is South Africa's Act 4 of 2013. Most of it took effect on July 1, 2020, with a one-year adaptation period that ended on June 30, 2021. Enforcement is by the Information Regulator, an independent body that also oversees the country's access to information law.

The law uses its own terms. Whoever decides why and how data is used is the responsible party, the equivalent of the GDPR controller. Whoever processes data on its behalf is the operator. The person the data refers to is the data subject, and here is an important difference: under POPIA, companies and other legal entities are also protected data subjects.

Personal information is anything that identifies someone, such as name, email, phone, location, online identifiers and opinions. There is also special personal information, which includes religion, racial origin, health, sex life, political opinion, biometrics and criminal record. Data of children, who under the law are people under 18, has its own protection.

The law applies to a responsible party established in South Africa and to one abroad that uses means in the country to process data. Whether this reaches a foreign site that merely receives South African visitors is a matter of interpretation. The prudent path for those with this audience is to follow the basic rules of transparency, security and marketing.

Checklist

What you need to meet

What POPIA and the Information Regulator require of a site with ads that receives visitors from South Africa.

  1. Give notice at collection

    Say what you collect, who is responsible and their address, the purpose, whether providing it is voluntary, whether the data goes to another country and what the rights are, including complaining to the Regulator. Google also requires the policy to say that third parties, such as Google, use cookies to show ads.

    Example

    We collect your email to send job alerts. Providing it is voluntary. You can ask for access, correction or deletion and complain to the Information Regulator.

  2. Register the Information Officer

    In a company, the Information Officer is by default the chief executive. They can only take on the role after being registered on the Information Regulator's portal.

  3. Electronic marketing with consent

    Email, SMS and marketing messages can only go to people who consented or to customers, about similar products. The consent request can be made only once and only if the person has not refused before.

  4. Opt-out in every message

    Every marketing message must identify the sender and include a contact to ask to stop receiving them.

    Example

    You receive this email from Example Company. To stop receiving it, click Unsubscribe.

  5. Respect objections

    People can object to use based on legitimate interest and, at any time, to direct marketing. After the objection, the use of that data must stop.

  6. Special data only with consent

    Religion, racial origin, health, sex life, political opinion and biometrics are prohibited as a rule. The person's consent is one of the exceptions, and Google does not accept personalized ads based on this data.

  7. Children with prior consent

    Children's data can only be processed with the prior consent of a competent person, such as a parent or guardian, except for the exceptions in the law.

  8. Report unauthorized access

    If there is reason to believe someone without authorization accessed personal data, notify the Regulator and, as a rule, the affected people, as soon as reasonably possible.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or have its own message for South Africa, so the links below are from Google and the Information Regulator.

The heart of the law

The 8 conditions for processing data

POPIA organizes everything into eight conditions. If one of them fails, the processing is no longer lawful.

Accountability and quality

The responsible party is accountable for compliance with all the conditions and must keep the data complete, accurate and up to date.

Limitation and purpose

Collect only what is necessary, with a valid justification, and for a specific and explicit purpose, keeping the data only as long as needed.

Further use and openness

A new use must be compatible with the original. And the person must know, at the time of collection, who is collecting, for what and what their rights are.

Security and participation

Protect the data with technical and organizational measures and allow the person to access, correct and request deletion of the information.

Legal bases, cookies and marketing

When the site can use the data

POPIA accepts six justifications for processing data: consent, performance of a contract, legal obligation, protection of a legitimate interest of the data subject, performance of a public duty and legitimate interest of the responsible party or a third party. The data subject can object to processing based on legitimate interest, and since 2025 this objection is free and can be made through several channels.

The law has no specific rule on cookies, like the UK PECR. But cookies and identifiers that allow a visitor to be recognized are personal information, so the site needs a justification and must give notice. For ad tracking, consent is the safest basis and the easiest to demonstrate.

The strictest point of the law is direct marketing by electronic means, such as email, SMS and automated calls. It is only allowed with consent or to customers who have already bought something, as long as the offer is for similar products and the person was given, at collection and in every message, a simple and free way to refuse.

The site can ask for this consent only once, and only if the person has not refused before. The rules updated in April 2025 say that consent can be obtained by any accessible means, but cannot be presumed from silence or a pre-ticked box. Every message must identify the sender and include a contact to request that it stop.

People's rights

What the data subject can ask for

They apply to people and also to companies whose data the site processes.

Be notified

Know that data is being collected and be informed if there was unauthorized access to it.

Access

Ask whether the site holds data about them and receive a description of what exists and who had access.

Correct and delete

Request correction or deletion of wrong, excessive or irregularly obtained data. Since 2025, the request is free and the response must come within 30 days.

Object

Refuse processing based on legitimate interest and, at any time, the use of data for direct marketing.

Not depend only on machines

Not be subject to decisions with a significant effect made solely by automated systems, except under the law's exceptions.

Complain and sue

File a complaint with the Information Regulator and go to court to seek redress.

Obligations

What a site with South African visitors needs to do

  1. Give notice at collectionThe privacy policy and forms must say who is collecting, for what, whether providing the data is mandatory, who the data is shared with, whether it goes to another country and what the data subject's rights are, including the right to complain to the Regulator.
  2. Have an Information OfficerEvery responsible party has an officer, who by default is the chief executive. They must be registered on the Information Regulator's portal before taking on the role.
  3. Ask for consent where it is the basisFor ad cookies and email lists, record consent with date, source and the text shown. No pre-ticked boxes.
  4. Protect the dataAdopt appropriate security measures and have a contract with operators, such as hosting and email tools, requiring the same care.
  5. Notify incidentsIf there is unauthorized access to personal data, notify the Regulator and those affected as soon as possible, with enough information for them to protect themselves.
  6. Handle transfersSending data out of the country requires that the destination offer adequate protection, that there is a contract with safeguards or the data subject's consent, among other cases in the law.

Enforcement and fines

What happens when the law is not followed

The Regulator receives complaints, investigates and issues enforcement notices. Ignoring a notice is the fastest path to a fine.

Administrative fine

The Regulator can impose a fine of up to 10 million rand through an infringement notice. Since 2025, it is possible to negotiate payment in installments.

Crimes with prison

Obstructing the Regulator or failing to comply with an enforcement notice can lead to up to 10 years in prison, a fine or both. Other offenses carry a penalty of up to 12 months.

First fine

In July 2023, the Regulator imposed the first fine under the law: 5 million rand on the Department of Justice, for not complying with a notice related to security failures.

Court actions

The data subject, or the Regulator on their behalf, can seek compensation for damages caused by irregular processing.

Timeline

From approval to enforcement

POPIA took years to get off the ground. These are the main dates.

  1. 2013

    Law passed

    POPIA is signed as Act 4 of 2013, but almost the whole text awaits a start date.

  2. April 11, 2014

    Basis for the Regulator

    The definitions and the rules that create the Information Regulator take effect.

  3. July 1, 2020

    The law starts to apply

    The main obligations take effect, with 12 months for companies to adapt.

  4. June 30, 2021

    End of the adaptation period

    The transition period ends and the law is enforced in full.

  5. July 2023

    First fine

    The Regulator fines the Department of Justice 5 million rand.

  6. April 17, 2025

    Updated regulations

    New rules on free objection, correction requests, consent for direct marketing and complaints take effect immediately.

For people with AdSense or Ad Manager

What changes in practice for revenue

Google does not require a certified CMP or the IAB TCF for South Africa. That requirement applies to the European Economic Area, the United Kingdom and Switzerland. So South African traffic keeps receiving personalized ads without the TCF message.

This does not remove POPIA obligations from the site. The privacy policy must mention the use of cookies and ad partners, and the visitor must have a way to object and to exercise their rights. If the site wants to ask for consent for ad cookies in the country, the CMP can do this by region, and Consent Mode passes the choice on to Google tags.

Imagine a Brazilian job site in English that receives visitors from Johannesburg and Cape Town and offers job alerts by email. The cookie banner can be simple, but the alerts form needs clear consent, with no ticked box, and every email needs an unsubscribe link.

Because POPIA also protects companies, a site that collects corporate contacts, for example for advertisers, must handle that data with the same care as data about people.

In practice

What is and is not allowed with POPIA

Everyday examples from content, job and finance sites with a South African audience.

Allowed

  • Showing Google personalized ads without the TCF message to visitors from South Africa
  • Sending a newsletter to people who signed up and ticked the box on their own
  • Sending similar offers to people who already bought from you, with an option to opt out in every message
  • Asking for marketing consent only once from people who never refused
  • Handling deletion and objection requests by email, WhatsApp or form, free of charge

Not allowed

  • Signing visitors up to email lists with a pre-ticked box
  • Insisting on the consent request after the person refused
  • Buying lists of emails or mobile numbers and blasting offers
  • Sending marketing without identifying the sender and without an unsubscribe link
  • Collecting data from people under 18 without a guardian's consent

Common errors

Where sites slip up most

Common failures on sites that receive an audience from South Africa.

Thinking that without a Google requirement, there is no rule

The lack of a mandatory CMP in the country does not waive the privacy policy, the right to object or the marketing rules.

Forgetting that companies are also data subjects

Contacts of advertisers, suppliers and partners are also data protected by POPIA.

Newsletter form without real consent

A pre-ticked box or hidden text does not count. The 2025 regulations made this explicit.

Information Officer not registered

The law requires the officer to be registered on the Regulator's portal before taking on the role.

Policy without international transfer

Visitor data goes to Google servers and other partners outside the country. The policy must say so.

Requests without a response

Correction and deletion requests must be answered within 30 days, and the site needs a clear channel to receive them.

In ConsentMode

What the audit checks for POPIA

  • Opens the site as a visitor from South Africa and records whether there is a banner, which buttons it offers and what fires before the choice.
  • Identifies the CMP from the page code, when there is one, and reads the Consent Mode signals sent to Google.
  • Checks whether the privacy policy includes the responsible party, purposes, ad partners, international transfer, rights and the officer's contact.
  • Checks newsletter and signup forms for pre-ticked boxes and a purpose notice.
  • Delivers screenshots and a fix plan prioritized by severity.
Run an auditSee everything that is checked

Frequently asked questions

Do I need a cookie banner for visitors from South Africa?

POPIA has no specific banner rule. The site must give notice about cookies and have a justification for using them. For ad tracking, asking for consent is the safest way, and a CMP set up by region solves it without affecting other audiences.

Does Google require anything for this traffic?

There is no certified CMP requirement for South Africa. Google's general publisher policies still apply, such as having a privacy policy that mentions cookies and ad partners.

Can I email people who left their contact in a comment?

Not for marketing. The contact was given for another purpose. To send offers, you need consent or a customer relationship with a similar product.

Who can be the Information Officer?

By default it is the company's chief executive, who can designate deputies. Registration is done on the Information Regulator's portal.

Is POPIA similar to the LGPD?

In many points, yes: legal bases, rights and the officer. The most visible differences are the protection of companies as data subjects, the age of 18 for a child and the strict rule on electronic marketing.

Is there really prison?

Yes, for specific crimes, such as obstructing the Regulator or failing to comply with an enforcement notice. For most everyday failures, the path is the notice and the administrative fine.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether your site is ready for the South African audience

The audit opens the site from South Africa and shows what to fix in the banner, forms and policy, without changing anything.

Start the audit